Image Credit: Shutterstock
Key Takeaways
- Lazarus Group-linked wallets sold over $30 million in Bitcoin on Hyperliquid, moving proceeds through Kraken, LBank and KuCoin.
- The activity surfaces as CFTC Chair Mike Selig works on a pathway to bring Hyperliquid into the regulated U.S. market.
- CME Group and ICE have urged scrutiny of Hyperliquid, while filings flag its exposure to sanctions evasion risk.
Wallets tied to North Korea’s state-sponsored Lazarus Group have sold more than $30 million worth of Bitcoin on decentralized derivatives platform Hyperliquid over the past three weeks, according to blockchain data reviewed by analytics firm Arkham.
The activity surfaces as the Trump administration works on a pathway to bring Hyperliquid into the regulated U.S. financial system.
Blockchain Data Shows Lazarus-Linked Wallets Active on the Platform
Arkham’s data identifies wallets connected to Lazarus Group actively moving funds through Hyperliquid, selling Bitcoin and using the proceeds to acquire Ether and Solana. Those funds were then transferred to other crypto exchanges, including Kraken, LBank and KuCoin, according to the data.
The wallets Arkham linked to Lazarus were first identified by independent blockchain researcher ZachXBT in 2024.
It is not the only recent instance of suspected North Korean activity on Hyperliquid: in December 2024, security researcher Taylor Monahan identified separate wallets suspected of North Korean control that had been trading on the platform since at least October of that year.
This disclosure contributed to roughly $250 million in net outflows from Hyperliquid in a single day. Hyperliquid said at the time that the platform itself had not been exploited, and no user funds were lost.
The identities of the accounts receiving funds at the centralized exchanges named in the Arkham data have not been established, and it remains unclear whether those platforms were aware of the funds’ origin when they arrived. Hyperliquid did not respond to requests for comment.
Exchanges Respond With Compliance Assurances
A Kraken representative said the exchange treats compliance as central to its operations. “Compliance is foundational to how we operate,” the representative said, adding that Kraken partners with blockchain analytics providers to screen for sanctioned wallets before assets reach the platform.
An LBank representative said the exchange uses industry-standard monitoring tools, but noted that risks in the crypto industry are often not something any single platform can independently identify, describing the challenge as inherently cross-platform and cross-jurisdictional.
A KuCoin representative said the exchange could not verify or comment on the specific wallet activity without reviewing the underlying data directly, and noted that public blockchain data alone does not necessarily reflect the full range of compliance actions, such as account restrictions or regulatory reporting, that a platform may take after funds arrive.
Trump Administration Pushes to Bring Hyperliquid Into the U.S.
The Lazarus Group’s use of Hyperliquid could expose the platform to scrutiny under U.S. sanctions law even as the Trump administration explores bringing it into the regulated domestic market.
At a White House event earlier this month, President Trump said Commodity Futures Trading Commission Chairman Mike Selig was working on a pathway to bring Hyperliquid into the U.S. “in a fully compliant and legal fashion.”
Singapore-based Hyperliquid Labs is the core development company behind the Hyperliquid network. Bringing the platform into the U.S. regulatory system would require addressing rules governing derivatives exchanges, customer protections and market surveillance.
It would also require sanctions and anti-money-laundering risks tied to a platform that lets users trade directly from crypto wallets without traditional account-opening or identity checks.
Kraken’s parent company, Payward, is reportedly in advanced talks with Hyperliquid Labs to bring its perpetual futures products to U.S. traders.
Hyperliquid’s Rapid Growth Has Drawn Regulatory Scrutiny
Hyperliquid has become the dominant decentralized venue for perpetual futures, derivatives contracts that let traders speculate on asset prices without an expiration date.
According to DefiLlama data, the platform has processed more than $5 trillion in cumulative trading volume and currently holds about $13.3 billion in open interest, having handled roughly $205 billion in volume over the past 30 days alone.
That scale has drawn attention from both Wall Street and regulators. CME Group and Intercontinental Exchange both reportedly urged U.S. officials earlier this year to scrutinize Hyperliquid, warning the platform could facilitate market manipulation or sanctions evasion.
CME Group is currently suing the CFTC in an effort to block the regulator’s push to allow crypto perpetual futures on U.S. trading platforms, an active legal dispute that remains unresolved.
Sanctions Risk Has Surfaced in Regulatory Filings
Recent filings tied to proposed investment products based on Hyperliquid’s HYPE token have flagged sanctions exposure directly.
Crypto asset manager Bitwise stated in a May filing for its proposed HYPE exchange-traded fund that Hyperliquid’s developers and operators cannot compel users interacting directly with the blockchain to complete identity, anti-money-laundering or sanctions screening, meaning the network could potentially be used by sanctioned actors.
The U.S. Treasury’s Office of Foreign Assets Control sanctioned Lazarus Group in 2019 and has since identified specific crypto wallets and services the group has used to move stolen funds.
According to Chainalysis data, the value of crypto received by sanctioned entities rose 694% in 2025, as Russia, Iran, and North Korea increasingly relied on digital assets in state-backed financial and security operations.
